integ-tests-alpha: Access Denied when trying to list S3 buckets with awsApiCall:

[5nafu]

Describe the bug

When using the IntegTest.assertions.awsApiCall in a simple integration test, the test fails to deploy with an Error Access denied. An aws s3 ls works though in the same shell.

Expected Behavior

The API Call to succeed and the integration test to run and return successfull

Current Behavior

The integration test returns with an CREATE_FAILED error:

BaseIntegrationTestDefaultTestDeployAssert44E57D18 | 15:02:01 | CREATE_FAILED        | Custom::DeployAssert@SdkCallS3listBuckets | BaseIntegrationTest/DefaultTest/DeployAssert/AwsApiCallS3listBuckets/Default/Default (AwsApiCallS3listBuckets) Received response status [FAILED] from custom resource. Message returned: Access Denied (RequestId: 422c5e2c-0ab0-4f55-b387-ad919e4319b8)

 ❌  BaseIntegrationTest/DefaultTest/DeployAssert failed: Error: The stack named BaseIntegrationTestDefaultTestDeployAssert44E57D18 failed to deploy: CREATE_FAILED (The following resource(s) failed to create: [AwsApiCallS3listBuckets]. )
    at FullCloudFormationDeployment.monitorDeployment (/Users/tobias.vollmer/git/cdk-integ-runner/node_modules/aws-cdk/lib/index.js:433:10615)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async Object.deployStack2 [as deployStack] (/Users/tobias.vollmer/git/cdk-integ-runner/node_modules/aws-cdk/lib/index.js:436:199640)
    at async /Users/tobias.vollmer/git/cdk-integ-runner/node_modules/aws-cdk/lib/index.js:436:181046

 ❌ Deployment failed: Error: The stack named BaseIntegrationTestDefaultTestDeployAssert44E57D18 failed to deploy: CREATE_FAILED (The following resource(s) failed to create: [AwsApiCallS3listBuckets]. )
    at FullCloudFormationDeployment.monitorDeployment (/Users/tobias.vollmer/git/cdk-integ-runner/node_modules/aws-cdk/lib/index.js:433:10615)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async Object.deployStack2 [as deployStack] (/Users/tobias.vollmer/git/cdk-integ-runner/node_modules/aws-cdk/lib/index.js:436:199640)
    at async /Users/tobias.vollmer/git/cdk-integ-runner/node_modules/aws-cdk/lib/index.js:436:181046

The stack named BaseIntegrationTestDefaultTestDeployAssert44E57D18 failed to deploy: CREATE_FAILED (The following resource(s) failed to create: [AwsApiCallS3listBuckets]. )

Reproduction Steps

Using the integration test example on https://github.com/5nafu/cdk-integ-runner/blob/main/test-integ-tests/integ.demo.ts, run

$ npm integ-runner --directory ./test-integ-tests --parallel-regions eu-central-1 --update-on-failed

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.142.0

Framework Version

integ-runner@2.142.0-alpha.0

Node.js Version

v20.12.0

OS

OSX/Linux

Language

TypeScript

Language Version

No response

Other information

No response

[pahud]

Per document:

By default, the AwsApiCall construct will automatically add the correct IAM policies to allow the Lambda function to make the API call. It does this based on the service and api that is provided. In the above example the service is SQS and the api is receiveMessage so it will create a policy with Action: 'sqs:ReceiveMessage.

There are some cases where the permissions do not exactly match the service/api call, for example the S3 listObjectsV2 api. In these cases it is possible to add the correct policy by accessing the provider object.

declare const app: App;
declare const stack: Stack;
declare const integ: IntegTest;

const apiCall = integ.assertions.awsApiCall('S3', 'listObjectsV2', {
  Bucket: 'mybucket',
});

apiCall.provider.addToRolePolicy({
  Effect: 'Allow',
  Action: ['s3:GetObject', 's3:ListBucket'],
  Resource: ['*'],
});

In your case, you'll need 's3:ListBucket'.

Let me know if it works for you.

[github-actions]

This issue has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.